cccms/Gemfile.lock, branch erdgeist-modernize-auth

Implement transparent password hash migration

2026-07-16T17:45:42Z

Add has_secure_password and bcrypt while retaining compatibility with legacy SHA-1 password hashes. Existing users are upgraded to password_digest on their next successful login. Add regression tests covering both legacy and modern authentication paths.

Add rails_icons (Tabler) for SVG iconography

2026-07-12T21:41:52Z

Vendors the Tabler outline/filled icon sets via rails_icons' sync mechanism rather than a hand-rolled SVG set or a webfont -- this app had no icon system of any kind before. Icons are committed like any other static asset; re-syncing is only needed when adding an icon that isn't vendored yet, via the new `make sync_icons` target.

Retire vendored cacycle_diff.js for a diff-lcs-based diff view

2026-07-09T22:35:24Z

Revisions#diff now computes an inline or side-by-side word diff server-side (Page#diff_against, lib/html_word_diff.rb) instead of shipping raw/escaped content to the browser for a 2008-era vendored JS differ to mangle. View mode is picked via a `view` param, settable either on the diff page itself or directly from the revisions#index sticky bar next to "Diff revisions". Also fixes a pre-existing bug in RevisionsController#diff's single- revision branch, which set params[:start]/params[:end] instead of params[:start_revision]/params[:end_revision].

Replace awesome_nested_set with a plain parent_id-based NestedTree concern

2026-07-07T00:46:37Z

Root-caused this session: appending a child to any node never widened that parent's own rgt boundary, on the pinned revision (Gemfile tracked main directly, chasing a too-conservative gemspec constraint - not, as first assumed, a deliberate pin to avoid a known bug). Reproduced cleanly on a single ordinary create with no concurrency and no bulk operation involved, confirmed via the gem's own SetValidator, then confirmed as the root cause of nodes_controller_test.rb's 3 long-standing "pre-existing" failures - not three separate mysteries, one bug. admin_controller's sitemap needed its own real conversion, not just a drop-in: awesome_nested_set's lft column implicitly provided correct depth-first tree order for free, which the old code combined with a separate class-level each_with_level iterator. Both replaced by one method, self_and_descendants_ordered_with_level, computing an ordered [node, level] list in a single query-then-walk pass - checked against the actual view template first (admin/index.html.erb) rather than assumed, since it relies on list order alone to render correct visual nesting. lft/rgt/depth columns intentionally left in schema, unused - dropping them is a separate, deliberately deferred migration once this is proven running for a while, not bundled with the behavior change.

Fix DST drift in occurrence generation

2026-07-02T13:13:40Z

- Occurrence.generate_dates: use ChaosCalendar::occurrences_for_timezone with Time.zone.tzinfo.identifier — occurrences now keep wall-clock time across DST boundaries (19:00 stays 19:00 in summer and winter); requires chaoscalendar gem with occurrences_for_timezone support (Gemfile.lock bumped accordingly) - Occurrence.find_in_range: joins(:event) inner join excludes occurrences whose event no longer exists (107k orphaned rows from the pre-revival calendar era were purged from the test DB); includes(:node) retained for eager loading; column references qualified with table name

Stage 7: Rails 7.2 → 8.1 on Ruby 3.2.11

2026-06-27T14:58:53Z

- Bump Rails to 8.1.3 (Ruby unchanged at 3.2.11, new gemset rails8-upgrade) - config.load_defaults 8.1; merge app:update diffs for all environment files - Remove routing-filter 0.7.0; replace with native scope '(:locale)' in routes.rb and default_url_options in ApplicationController - Delete config/initializers/routing_filter_rails71_patch.rb - Replace vendored TinyMCE 3.x (~200 files) with tinymce-rails ~> 8.3; migrate admin_interface.js from jQuery .tinymce()/advanced theme to tinymce.init(); add config/tinymce.yml; note: TinyMCE 7+ is GPL - rails-i18n ~> 8.0 added explicitly (previously indirect dependency) - awesome_nested_set, acts-as-taggable-on pinned to git main/master (gemspec activerecord < 8.1 ceiling; no functional incompatibility; repin to version once upstream releases updated gemspecs) - globalize ~> 7.0, libxml-ruby ~> 5.0, nokogiri ~> 1.18, pg ~> 1.5 - sass-rails, coffee-rails, uglifier moved from :assets group to main (Sprockets 4 convention; :assets group no longer meaningful) - Node: head, draft, lock_owner marked belongs_to optional: true - Page: node, user, editor marked belongs_to optional: true - Static assets in public/images/ and public/javascripts/ referenced via plain HTML tags; Rails 8 load_defaults raises on pipeline helpers for undeclared assets - sessions_controller_test.rb: remove stale require and dead rescue_action - users_controller_test.rb: assert button[type=submit] not input[type=submit] (Rails 8 button_to renders

Update pg gem to ~> 1.5 now that PostgreSQL 16 is in use

2026-06-26T19:49:46Z

Stage 5 click-testing fixes

2026-06-26T11:40:55Z

- Fix link_to :method → button_to for all PUT/DELETE actions - Add button_to CSS reset to admin.css for visual consistency - Fix admin layout: replace broken jquery/jquery_ujs pipeline refs with admin_bundle via sprockets; add sprockets-rails, jquery-ui-rails gems - Add app/assets/javascripts/admin_bundle.js pipeline manifest - Fix event_information helper: use safe_join to avoid double-escaping - Fix nodes_helper: to_s(:db) → to_fs(:db) for event times - Fix revisions view: eliminate nested forms; diff button uses vanilla JS to collect radio button values before POST - Fix config/environments/development.rb and test.rb: cache_classes → enable_reloading - Add routing_filter_rails71_patch.rb version guard - Move LockedByAnotherUser to own file for Zeitwerk autoloading - Fix Globalize fallbacks via config.i18n.fallbacks in application.rb

Stage 5 fixes: RouteWithParams removal, Globalize fallbacks, search stub, to_s(:db) → to_fs(:db), LockedByAnotherUser autoload, test environment config

2026-06-26T03:19:28Z

- Remove safe_path helper and content_path shim from link_helper.rb - Update all safe_path call sites in views to use named route helpers directly - Fix Globalize fallbacks via config.i18n.fallbacks in application.rb, remove i18n initializer - Stub Node.search returning none (search disabled pending PostgreSQL upgrade) - Replace to_s(:db) with to_fs(:db) in node.rb, nodes_helper.rb, link_helper.rb, admin view - Move LockedByAnotherUser to app/models/locked_by_another_user.rb for Zeitwerk autoloading - Fix config/environments/test.rb: config.assets removed, cache_classes → enable_reloading, test_order removed, minitest pinned to ~> 5.25 - Fix config/environments/development.rb: cache_classes → enable_reloading - Park search vector migration in doc/ pending PostgreSQL and plpgsql availability

Stage 5: Rails 6.1 → 7.2 on Ruby 3.2.11

2026-06-26T02:05:04Z

- Bump Rails to 7.2.3, Ruby to 3.2.11 (new gemset rails7-upgrade) - pg pinned to 1.4.6 (bridge: Ruby 3.2 compatible, PostgreSQL 9.6 tolerant) - acts-as-taggable-on → 12.x (Rails 7.2 + Ruby 3.2 support) - awesome_nested_set → 3.7.0 (Rails 7.2 support, avoids 3.9.0 lft/rgt bug) - globalize → 7.0 (Rails 7.x required) - libxml-ruby → 5.x (Ruby 3.2 required) - unicorn → 6.x; fix unicorn.rb: RAILS_ROOT→Rails.root, RAILS_ENV→ENV, File.exists?→File.exist? - Add puma for development server - Remove dead initializers: assets.rb, ruby2.rb, backtrace_silencers.rb, new_rails_defaults.rb - Fix File.exists? → File.exist? in page.rb and authors_importer.rb - Add routing_filter_rails71_patch.rb (restores params[:locale] on Rails 7.1+)